SecondMind

Autonomous three-tier memory with proactive initiative, project tracking, and social intelligence. Ingests OpenClaw conversations, extracts knowledge + emoti...

Security Scan

SecondMind's code, runtime instructions, and external usage are consistent with an autonomous memory/initiative assistant that reads OpenClaw sessions, stores local state, calls OpenRouter for LLM work, and optionally notifies via Telegram/Discord — but it installs persistent cron/tasks and asks you to provide an API key, so review config and cron changes before installing.

Purpose & Capability

The skill name/description (autonomous memory, proactive suggestions) lines up with the code and instructions: it ingests OpenClaw JSONL sessions, stores them in a local SQLite DB, runs consolidation/initiative jobs, uses an LLM provider (OpenRouter), and offers Telegram notifications and project tracking. Required binary is just node, which matches the Node.js implementation.

Instruction Scope

SKILL.md and AGENT-SETUP.md explicitly instruct running setup.js, creating cron/scheduler jobs, and running multiple scripts (ingest, consolidate, initiative, flush, etc.) that read session files and write to a local DB. This is within the stated scope. Two items to be aware of: (1) a CRITICAL pre-reset step instructs running flush.js to capture active session contents prior to resets (intended for data retention but will capture ephemeral session content), and (2) AGENT-SETUP.md instructs the agent to ask the user for their OpenRouter API key — users should be cautious about supplying secrets via an agent prompt.

Install Mechanism

The skill's install step runs npm install --production in the repo, which pulls dependencies declared in package.json (notably better-sqlite3, etc.). This is a standard package install from npm (no arbitrary URL downloads observed). better-sqlite3 is a native module and may require build tools. Registry metadata earlier said 'no install spec' while SKILL.md includes an install command — a minor metadata inconsistency but not a direct security indicator.

Credentials

The skill does not require OS credentials or unrelated secrets. It expects an OpenRouter API key (stored in config.json) and optionally Telegram bot token / Discord webhook for notifications — these are proportional to the stated functionality. One mismatch: registry/metadata lists no required env vars, yet setup and docs require an OpenRouter API key in config.json (not an env var). The agent-assisted setup suggests prompting the user to provide the OpenRouter key — treat that as sensitive and only provide it if you trust the skill/agent and understand billing implications.

Persistence & Privilege

The skill does not set always:true and does not alter other skills. However, setup.js installs persistent background jobs (crontab on Linux or scheduled tasks on Windows) that will run regularly and perform ingestion, consolidation, archival, and initiative tasks. This persistent scheduling is consistent with the skill purpose but is a meaningful level of system presence that the user should explicitly approve and review.

Assessment

SecondMind appears to do exactly what it claims: it reads your OpenClaw session JSONL files, stores local SQLite records, calls OpenRouter for LLM operations, and can notify via Telegram/Discord. Before installing, consider the following: - Review the code and config.json yourself (or in a sandbox) before running setup.js. The repository will create a local data directory (data/secondmind.db) and install cron/Task Scheduler jobs that run every 30 minutes / 6 hours / daily — check and approve those changes. - Keep your OpenRouter API key and Telegram bot token private. The skill asks you to add the OpenRouter key into config.json (or to provide it via an agent prompt); only provide the key if you trust the environment and accept potential API usage/billing. - The skill will capture session contents (including active sessions) during its flush/ingest flows; if you have sensitive conversation content, review what gets stored and where (data/). - Cron jobs and the standalone bot will generate periodic outbound network traffic (OpenRouter API + optional Telegram/Discord). Expect small, recurring API usage and costs; choose model settings carefully. - If you are uncomfortable with persistent background jobs, run the scripts manually for testing (node scripts/status.js, ingest.js, consolidate.js, initiative.js) instead of installing cron/schtasks. Minor metadata note: registry metadata said “no install spec” while SKILL.md includes an npm install step — that mismatch likely reflects metadata staleness but you should verify the install steps prior to running them.

SecondMind – Autonomous AI Memory, Initiative & Social Intelligence

When To Use

Activate this skill when the user:

• Asks to set up, configure, or check SecondMind status
• Wants to search their knowledge base or recall past conversations
• Asks for proactive suggestions or project ideas
• Mentions memory, remembering, or context from past sessions
• Sends /new or /reset (trigger pre-reset flush!)
• Asks about their mood/emotional patterns or upcoming events
• Sends any SecondMind Telegram command (see below)

First-Run Setup

If the database does not exist at {baseDir}/data/secondmind.db:

node {baseDir}/setup.js

Then guide the user through editing {baseDir}/config.json:

1. Set openrouter.apiKey (required – get one at https://openrouter.ai/keys)
2. Check openclaw.sessionsDir matches their agent's session path
3. Optional: Enable Telegram notifications

CRITICAL: Pre-Reset Memory Capture

When the user sends /new or /reset:

1. BEFORE the reset takes effect, run:

   node {baseDir}/scripts/flush.js
   

2. Respond with the script's output (e.g. "💾 Session archived.")
3. THEN allow the reset to proceed normally

Telegram Commands (Integrated Mode)

When telegramMode is "integrated" in config.json, the OpenClaw agent handles these commands directly. Execute the corresponding script and format the response.

/smstatus or /es

node {baseDir}/scripts/status.js

/proposals or /ep [filter]

node {baseDir}/scripts/proposals.js [proposed|accepted|rejected|all]

/accept <ID...> [comment] or /ea <ID...> [comment]

node {baseDir}/scripts/feedback.js accept <ID...> [comment]

Supports multiple IDs: /accept 1 3 5 or /accept all After accepting, a project is automatically created to track progress.

1. Read the proposal's follow_up field from the database: sqlite3 {baseDir}/data/secondmind.db "SELECT follow_up, description FROM proposals WHERE id=<ID>"
2. If there's a follow_up question, ask the user that question
3. If the user agrees, start working on the task immediately
4. Example flow:
   • User: /accept 5
   • Agent: "✅ #5 akzeptiert. Soll ich dir die Guide-Liste direkt zusammenstellen?"
   • User: "Ja mach"
   • Agent: starts working on the task

/reject <ID...> [comment] or /er <ID...> [comment]

node {baseDir}/scripts/feedback.js reject <ID...> [comment]

Supports multiple IDs: /reject 2 4 or /reject all Acknowledge briefly. Don't make a big deal out of it.

/defer <ID...> [comment] or /ed <ID...> [comment]

node {baseDir}/scripts/feedback.js defer <ID...> [comment]

/drop <ID...> or /drop all older_than <duration>

node {baseDir}/scripts/feedback.js drop <ID...>
node {baseDir}/scripts/feedback.js drop all older_than 14d

Permanently kills proposals – they will never be suggested again, not even reformulated. Supports: /drop 2 4, /drop all, /drop all older_than 14d

/projects or /pj [filter]

node {baseDir}/scripts/proposals.js  # (projects are shown in status)

Lists tracked projects. Filter: active (default), completed, all. Projects are auto-created when proposals are accepted.

/complete <ID...> or /done <ID...>

node {baseDir}/scripts/feedback.js complete <ID...>

Marks a project as completed. Completed projects are permanently excluded from future suggestions. The ID refers to the original proposal ID.

/mute <duration> or /unmute

node {baseDir}/scripts/feedback.js mute 1d
node {baseDir}/scripts/feedback.js mute 1w
node {baseDir}/scripts/feedback.js unmute

Pauses all notifications and initiative runs for the given duration. Durations: 1h, 1d, 1w, 2w

Natural Language Feedback

The bot understands natural language feedback on the most recently shown proposals:

• "Nimm die ersten zwei, den Rest ignorieren"
• "1 und 3 sind gut, Rest weg"
• "Alle droppen bis auf die Security-Sachen"

/smsearch <query> or /smsr <query>

node {baseDir}/scripts/search.js "<query>" --no-rerank

/mood or /em

Query the database at {baseDir}/data/secondmind.db:

SELECT mood, COUNT(*) as count FROM social_context
WHERE detected_at > datetime('now', '-7 days')
GROUP BY mood ORDER BY count DESC;

Format with emoji: 😤frustration 🎉excitement 😰worry 🥳celebration 😫stress 🤔curiosity 😴boredom 🙏gratitude

/smrun or /smrun

cd {baseDir} && node scripts/ingest.js && node scripts/consolidate.js && node scripts/initiative.js

Standalone Telegram Bot (Alternative Mode)

When telegramMode is "standalone", the user runs a separate bot daemon:

node {baseDir}/scripts/telegram-bot.js

This requires a dedicated Telegram bot token (different from the OpenClaw agent's bot). The standalone bot handles all the same commands listed above via its own polling loop.

Background Jobs (installed by setup.js)

• Ingest: Every 30 min – imports JSONL session transcripts
• Consolidate: Every 6h – LLM extracts knowledge + emotions + events
• Archive: Daily 3:00 AM – promotes mature knowledge to long-term FTS5 index
• Initiative: Every 6h – generates proposals and sends Telegram notifications

Configuration

Edit {baseDir}/config.json:

• openrouter.apiKey: OpenRouter API key (REQUIRED)
• openclaw.sessionsDir: Path to your agent's sessions directory
• telegramMode: "integrated" (via OpenClaw) or "standalone" (separate daemon)
• notifications.enabled: true to push proposals to Telegram
• notifications.telegram.botToken: Your Telegram bot token
• notifications.telegram.chatId: Your Telegram chat ID
• models.*: LLM model assignments (pre-optimized, change only if needed)
• initiative.reminderCooldownDays: Days before reminding about deferred proposals (default: 7)
• initiative.maxNudgesPerProposal: Max reminders before auto-archiving (default: 2)
• initiative.dedupThreshold: Semantic similarity threshold for dedup (default: 0.85)

Troubleshooting

• "Database locked": Cron job running. Wait 30s.
• "OpenRouter error": Check API key + credit balance at openrouter.ai
• "No new data": Check openclaw.sessionsDir in config.json
• Telegram conflict: Two bots polling same token → use integrated mode or create second bot
• Reset: node {baseDir}/setup.js --reset

Cost

~$0.60-1.65/month via OpenRouter Cloud. See https://openrouter.ai/models for current prices.